Privacy policy

This policy explains what personal information MiMi collects, why, who we share it with and the choices you have. It covers mimi.link and every MiMi page.

Who we are

("MiMi", "we", "us"). We are the controller of the personal information described here, except where we say otherwise.

Questions or requests: [email protected] or our contact page.

The short version

• Visitors to MiMi pages are not tracked with cookies, and we never sell anyone's data.
• If you have an account, we keep what we need to run it, keep it secure and stop abuse.
• Payments go through Stripe and email through Brevo. We never see full card numbers.
• You can ask for a copy of your data, or for it to be deleted, at any time.

If you have a MiMi account

What you give us

• Your email address and password (we only store a scrambled version of the password that can't be turned back).
• Your page: your link, name, bio, photo, links, design choices and anything else you add.
• If you sign in with Google, TikTok or another provider: the ID that provider gives us, your name, profile photo and, where the provider shares it, your email address. We don't get your password for that service and we can't post as you.
• If you sell or take tips: the Stripe account you connect, your products and the files you upload.
• If you upgrade to MiMi Pro: your subscription status (Stripe handles the card).
• If you contact us: your message and the details you include.

What we collect automatically

• The IP addresses your account signs in and works from, with the date, country and browser, and a record of sign-ins and uploads. We keep this to protect your account and to investigate and report abuse, for example illegal content uploaded through a VPN. It's deleted after 12 months, unless we need it longer for a legal reason or an open investigation.
• A fingerprint (SHA-256) of each file you upload for sale, so a file can be identified if it's reported.

Why we use it and our lawful basis

• To provide your account, your page and the features you use (contract).
• To keep MiMi secure, prevent fraud and spam, check uploaded downloads and new accounts' links against our rules, and report illegal content to the authorities where the law requires it (legitimate interests and legal obligation).
• To send emails about your account, such as confirming your address, password resets, purchase receipts and decisions about your content (contract).
• To send product news, only if you opted in (consent; you can opt out at any time).

If you visit a MiMi page

Public MiMi pages don't set cookies and don't use advertising or tracking tools.

To show creators how their page is doing, we count views and clicks with the country, device type and the site you came from. To count unique visitors without tracking you, we use a code made from your IP address, browser and the date that can't be turned back into your IP address. It changes every day and is deleted after two days.

Video and music players (YouTube, Spotify and so on) only load when you tap play. Once you do, that service's own privacy policy applies.

If you join a creator's mailing list, tip or buy

• Mailing lists: when you sign up on someone's page, the creator receives your email (and name, if asked) and may send it to their own email service, such as Mailchimp or Brevo. The creator is responsible for how they use it; we store and pass it on for them. To unsubscribe, use the link in their emails or contact the creator.
• Tips and purchases: payment is handled by Stripe, and the money goes to the creator's own Stripe account. We receive your email, name if you give it, and what you bought, so we can send your download link and receipts. We never see full card details.

Who we share information with

We only share what each service needs to do its job:

• Stripe: payments and Pro subscriptions.
• Brevo: sending our emails.
• Anthropic (Claude): our AI features, the page importer and the automatic checks on uploads and new accounts' links. What's sent is the content being checked or written, not your password or payment details.
• Cloudflare: website security and speed, including scanning images for known child sexual abuse material.
• Google, TikTok and other sign-in providers: only if you choose to sign in with them.
• Our web host, which stores the site and database.
• The authorities, where the law requires it, for example reports of child sexual abuse material to the National Crime Agency or the Internet Watch Foundation.
• A buyer of our business, if MiMi is ever sold, under the same protections.

Some of these providers store data outside the UK, including in the United States. Where they do, the transfer is protected by an adequacy decision or the standard contract clauses approved for UK data.

How long we keep it

• Your account and page: until you delete your account. Most data is then removed within 30 days, apart from what we must keep for tax, accounting or legal reasons.
• Security and IP records: 12 months.
• Visitor counting codes: 2 days. Page statistics are kept as totals.
• Messages to us: as long as needed to deal with them.
• Orders: as long as the law requires for financial records.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal information;
• correct it;
• delete it;
• restrict or object to how we use it;
• send it to you or another service in a portable format;
• stop sending you marketing (also via the link in any marketing email).

To make a request, email [email protected] from your account's email address. We'll reply within one month.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk.

Cookies and similar storage

We only use what's needed for MiMi to work. Public pages set none.

• mimi_sess: keeps you signed in during a visit to your account pages. It ends when you close your browser.
• mimi_remember: only if you tick "Keep me signed in". It keeps you signed in for 30 days.
• Your browser's local storage remembers small choices, for example if you dismissed the "add to home screen" tip.
• The Google sign-in button, if you use it, is provided by Google and may use Google's own cookies.

We don't use advertising or analytics cookies, so there's nothing to accept or decline.

Children

MiMi is not for children under 13. If you think a child under 13 has given us information, please contact us and we'll delete it.

Changes to this policy

If we make important changes, we'll update the date at the top and tell account holders by email or in their dashboard.